South Korea’s Financial Services Commission is requiring the country’s crypto exchanges to maintain round-the-clock system monitoring. Under emergency security guidelines announced on November 12, 2026, virtual asset service providers must monitor their systems 24/7, with dedicated personnel assigned to the task.
The rules also call on exchanges to keep as much of their users’ crypto as possible in cold wallets. They lay the groundwork for bank-level IT standards under the forthcoming Digital Asset Act.
The timing is notable. The guidelines follow a significant security incident involving a hack at Binance, underscoring that even the largest platforms can be caught off guard.
What the FSC is actually requiring
The central requirement is continuous system monitoring. Every virtual asset service provider, or VASP, must assign staff specifically to watch for problems around the clock.
Monitoring alone is not enough. Exchanges must also have immediate response protocols ready for suspicious activity, including unusually large transactions.
The most notable change concerns when exchanges can halt activity. The guidelines include a no-action letter mechanism that allows exchanges to freeze deposits and withdrawals if they suspect a breach, without waiting for hacking to be confirmed. A no-action letter is essentially regulatory reassurance that a firm will not be penalized for a specific action.
The guidelines also encourage exchanges to maximize the share of user assets held in cold wallets, which are offline storage systems disconnected from the internet.
Most exchanges already clear the bar
The figures offer some context. South Korea’s Virtual Asset User Protection Act mandates a legal minimum of 80% for cold wallet storage. The industry average was already above 95%, according to figures from late 2026.
The leading exchanges are well above the threshold. Upbit reports cold wallet holdings above 99%. Bithumb’s ratio is approximately 94-95%.
Coinone’s ratio is around 85%. That is comfortably above the legal minimum, but noticeably below those of its larger rivals.
The bigger regulatory picture
These emergency guidelines pave the way for broader changes. The forthcoming Digital Asset Act is set to impose bank-level IT safety standards on VASPs. It would also establish liability for damages, meaning exchanges could be held responsible when users lose money because of security failures.
South Korea has been steadily bringing crypto exchanges closer to the operational standards applied to traditional financial institutions. The stated aim is to strengthen the country’s position as a major crypto trading hub while improving consumer protections, as fraud and theft incidents in the industry continue to accumulate.
What this means for exchanges and users
For users, the immediate implications are mostly positive. Round-the-clock monitoring and faster powers to freeze activity should, in theory, reduce the time attackers have to drain funds. High cold storage ratios mean that even a successful breach of hot wallets would expose a smaller share of total assets.
There is a tradeoff: allowing deposits and withdrawals to be frozen on suspicion alone means users could sometimes find their funds temporarily locked because of a false alarm.
Key points to watch include the final text of the Digital Asset Act and the wording of its liability provisions. It will also be worth tracking how often exchanges use the new freeze powers and whether Coinone raises its cold wallet ratio closer to those of its rivals.
